D-Link DAP-1160 Unauthenticated Remote Configuration

Security Advisory IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote Configuration Advisory Information -------------------- Published: 2010-06-28 Updated: 2010-06-28 Manufacturer: D-Link Model: DAP-1160 Firmware version: 1.20b06 1.30b10 1.31b01 Vulnerability Details --------------------- Publi...

IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote Configuration

Security Advisory IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote Configuration Advisory Information -------------------- Published: 2010-06-28 Updated: 2010-06-28 Manufacturer: D-Link Model: DAP-1160 Firmware version: 1.20b06 1.30b10 1.31b01 Vulnerability Details --------------------- Publi...

Hacker Charged Who Sent Threats to VP Biden

A hacker tried to frame his neighbor by tapping into his Wi-Fi and sending threatening emails to US vice president Joe Biden, according to search warrant affidavits unsealed recently. Read the full article. The Register...

Last Week in Security

This was an amazingly busy news week in the security world, with a lot of major stories competing for your attention: Microsoft sharing pre-patch vulnerability data with foreign governments, IBM handing out certified pre-owned USB keys, Google spying on Wi-Fi users. If you missed anything, never...

Google in Apology Mode After WiFi Data Grab

Google co-founder Sergey Brin says the company “screwed up” when it equipped its world-roving Street View cars with software code that spent three years capturing personal data from open Wi-Fi networks. “Let me just say: We screwed up,” Brin told a room full of reporters this afternoon at the...

Microsoft Patches Worm Holes in Mail Server, Visual Basic for Apps

Microsoft today issued patches for a pair of critical remote code execution vulnerabilities in Windows and Microsoft Office and urged affected users to apply the fixes as soon as possible. The most serious issue, addressed in the MS10-030 bulletin, affects Outlook Express, Windows Mail and Window...

Design/Logic Flaw

The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to 1 change the admin password via the adminpassword parameter, 2 disable the security requirement for the Wi-Fi network via unspecified vectors, or 3 modify DNS...

CVE-2009-4821

The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to 1 change the admin password via the adminpassword parameter, 2 disable the security requirement for the Wi-Fi network via unspecified vectors, or 3 modify DNS...

CVE-2009-4821

The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to 1 change the admin password via the adminpassword parameter, 2 disable the security requirement for the Wi-Fi network via unspecified vectors, or 3 modify DNS...

CVE-2009-4821

CVE-2009-4821 affects the D-Link DIR-615 router (firmware 3.10NA). The vulnerability is that apply.cgi does not require administrative authentication, allowing remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the Wi‑Fi security requirement via unspec...

iPhone, Android, Others Get Man in the Middle Treatment

Security researchers have released a paper detailing successful man-in-the-middle attacks against several smartphones. The SSL enabled log in sessions on the tested, Nokia N95, HTC Tilt, Android G1 and iPhone 3GS devices was sniffed using the publicly available SSLstrip tool, with the attack taki...

CVE-2009-0052

The Atheros wireless driver, as used in Netgear WNDAP330 Wi-Fi access point with firmware 2.1.11 and other versions before 3.0.3 on the Atheros AR9160-BC1A chipset, and other products, allows remote authenticated users to cause a denial of service device reboot or hang and possibly execute...

CVE-2009-0052

The Atheros wireless driver, as used in Netgear WNDAP330 Wi-Fi access point with firmware 2.1.11 and other versions before 3.0.3 on the Atheros AR9160-BC1A chipset, and other products, allows remote authenticated users to cause a denial of service device reboot or hang and possibly execute...

Atheros Driver Reserved Frame Vulnerability

Title: ------ Atheros Driver Reserved Frame Vulnerability Summary: -------- The wireless driver in some Wi-Fi access points such as the ATHEROS-based Netgear WNDAP330 do not correctly parse malformed reserved management frames. Assigned CVE: ------------- CVE-2009-0052 Details: -------- The bug c...

Marvell Driver Multiple Information Element Overflows

Title: ------ Marvell Driver Multiple Information Element Overflows Summary: -------- The wireless drivers in some Wi-Fi access points such as the MARVELL-based Linksys WAP4400N do not correctly parse information elements included in association requests. Most information elements are used by the...

Cross site request forgery (csrf)

Cross-site request forgery in cp06wifimnocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and wlRadioEnable parameters...

CVE-2008-7165

Cross-site request forgery in cp06wifimnocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and wlRadioEnable parameters...

CVE-2008-7165

CVE-2008-7165 describes a cross-site request forgery in the cp06_wifi_m_nocifr.cgi admin panel of TELECOM ITALIA Alice Gate2 Plus Wi‑Fi gateways. The underlying issue allows remote attackers to hijack administrator authentication and issue requests that disable Wi‑Fi encryption by crafting specif...

Default configuration

The default configuration of the Wi-Fi component on the Axesstel MV 410R does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2009-2319

The default configuration of the Wi-Fi component on the Axesstel MV 410R does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...